---
id: "CVE-2026-110026"
kind: "vulnerability"
aliases: ["CVE-2026-110026"]
title: "Tasty Recipes Lite WordPress plugin lets contributors delete any taxonomy term"
severity: "medium"
cvss: 4.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "wordpress"]
not_affected_if: ["default-config"]
published_at: "2026-10-18T07:16:51+00:00"
first_seen_at: "2026-10-23T21:57:14+00:00"
updated_at: "2026-10-25T04:32:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110026", "first_seen_at": "2026-10-23T21:57:14+00:00"}]
---

# Tasty Recipes Lite WordPress plugin lets contributors delete any taxonomy term

The Tasty Recipes Lite WordPress plugin before 1.2.11 does not check user capabilities when creating, renaming or deleting taxonomy terms. A logged-in user with the Contributor role can add, rename and permanently delete terms in any taxonomy, including categories, tags and navigation menus.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the Tasty Recipes Lite plugin in the WordPress admin under Plugins; affected if below `1.2.11`
- Review user accounts with the Contributor role or higher on the site

## Fix

- Update Tasty Recipes Lite to `1.2.11` or later

## Timeline

- 2026-10-23T21:57:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-110026

## From the sources

The Tasty Recipes Lite  WordPress plugin before 1.2.11 does not correctly check user capabilities when creating, renaming and deleting taxonomy terms, allowing users with a role as low as Contributor to add, rename and permanently delete terms in any taxonomy on the site, including categories, tags and navigation menus.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_